After the success of my js compression challenge =) I thought it would be cool to try and figure out what I've been experimenting with. How many vectors can you fit into one vector. The idea is you take the following vector:-

and it works in all contexts :D so... x='vector'; or x="vector" or <input x="vector"> or <a onclick="x='vector'"> etc

Rules
-----
1. Only one payload e.g alert(1) must be called by all vectors no duplicates
2. The vector must work in all contexts you define
3. Most contexts wins and shortest overall vector
4. Any type of vuln is allowed :) SQLi, remote inclusion, xss etc

I guess I could add %> and ?> but there would be more severe problems anyway if these worked

>
> 4) There is always a tiny chance that some
> structures will not be interrupted. I mean
>
> http://heideri.ch/#91
>
> We can open any number of sections within other
> sections. But it is only in theory.
>
> 5) May be it might be better to add
> -ms-behavior:url(#default#time2) + onbegin , so
> this vector is able to work in compatibility mode
> for IE8+?

Cool idea. May want to add variable width encoding escape here too... although technically it qualifies as an attribute escape, so maybe it gets you no extra points. Same deal with null bytes in HTML tags - not sure if that gives you extra points by those rules.

Yeah those are valid as a filter could filter some HTML tags but miss null bytes too but anyway I got bored of this challenge after around 19 vectors and it becomes a pain in the ass to test after a while